CVE-2025-56379

CVE-2025-56379 — Stored Cross-Site Scripting XSS in ERPNext 15.67.0 / Frappe 15.72.4 📌 Summary A stored Cross‑Site Scripting XSS vulnerability exists in the Blog module of ERPNext v15.67.0 / Frappe v15.72.4. An authenticated user who can create or edit blog posts may inject crafted HTML/JavaScrip...

CVE-2025-56380

CVE-2025-56380 — Time-based Blind SQL Injection in Frappe / ERPNext frappe.client.getvalue 📌 Summary A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework v15.72.4 and present in ERPNext v15.67.0 codebase. An authenticated use...

CVE-2025-28062

CVE-2025-28062 — Vulnerabilidad CSRF que permite la toma de control de cuentas en ERPNext 14.82.1 , 14.74.3 📌 Resumen Se descubrió una vulnerabilidad de Cross-Site Request Forgery CSRF en ERPNext 14.82.1 y 14.74.3 , que permite a atacantes realizar acciones no autorizadas como: Enumeración de...

CVE-2025-56381

CVE-2025-56381 — Authenticated SQL Injection in ERPNext / Frappe via orderby and groupby Parameters 📌 Summary ERPNext v15.67.0 and Frappe Framework v15.72.4 contain multiple authenticated SQL injection vulnerabilities in the frappe.desk.reportview.get API endpoint. Malicious input to the orderby ...

CVE-2022-28598

ERPNext - 12.29.0 Stored cross-site scripting XSS vulnerability in the "lastknownversion" field found in the "My Setting" page in ERPNext 12.29.0 allows remote attackers to inject arbitrary web script or HTML via a crafted site name by doing an authenticated POST HTTP request to...

CVE-2026-96672

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

EUVD-2026-85344

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-96672

Frappe ERPNext versions before 16.34.1 are vulnerable to an unauthorized method invocation due to insufficient validation of calculation_formula values within Financial Report Templates. The application fails to verify that these values reference whitelisted methods before passing them to frappe....

CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-96672: Use of Externally-Controlled Input to Select Classes or Code

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

PT-2026-97358

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 16.34.1 Description Accounts Managers can invoke non-whitelisted internal server-side methods and read their return values. This occurs because the software fails to validate that the calculation formula values...

CVE-2026-94113

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94113

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain a missing authorization vulnerability in three whitelisted timesheet endpoints (get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet) that fail to enforce doctype permissions. An authenticated attacker...

CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

EUVD-2026-83735

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

CVE-2026-94113 Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call getprojectwisetimesheetdata, gettimesheetdetailrate, and gettimesheet...

PT-2026-95969

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.0 Frappe ERPNext versions 16.x prior to 16.34.0 Description An information disclosure issue exists in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can...